Windows SyncAppvPublishingServer.vbs Execution Triggers PowerShell via Semicolon

title: Windows SyncAppvPublishingServer.vbs Execution Triggers PowerShell via Semicolon
id: a4634ed4-c3ee-4bbc-a45a-88cedd659147
status: test
description: This rule identifies process executions where the command line includes SyncAppvPublishingServer.vbs and also contains a semicolon, indicating the script is being used to pass additional commands. Attackers can leverage this behavior to run arbitrary PowerShell payloads through trusted Windows tooling. The detection relies on Windows process creation telemetry with access to the full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md
  - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml
author: frack113, Huntrule Team
date: 2021-07-16
modified: 2022-06-22
tags:
  - attack.stealth
  - attack.t1218
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \SyncAppvPublishingServer.vbs
      - ;
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 36475a7d-0f6d-4dce-9b01-6aeb473bbaf1
    type: derived